   (stop [this] this)
 
   UserAuthenticator
-  (allowed-user? [this uid pw]
+  (authenticate-user [this uid pw]
     (when-let [hash (get-hash-for-uid (:password-store this) uid)]
       (verify-password pw hash)
       ;; TODO There is a slight security concern here. If no uid is

    (when this {})))

(defprotocol UserAuthenticator
  (allowed-user? [_ user password]))

(extend-protocol UserAuthenticator
  Boolean
  (allowed-user? [this user password] this))

(def PASSWORD_HASH_ALGO "PBKDF2WithHmacSHA1")



    (if (and username
             (not-empty username)
             (authenticate-user user-authenticator (.trim username) password))

      {:status 302
       :headers {"Location" (or requested-uri "/")} ; "/" can be parameterized (TODO)
